Google Cloud tools
Who can actually reach it, and which credential never expires.
GCP IAM is additive down the resource hierarchy and a child cannot revoke what was granted above it, so a resource's own policy tells you what was granted there rather than who can reach it. allAuthenticatedUsers is not your organisation: it is any Google account in existence. And a downloaded service account key is the one credential in Google Cloud with no expiry and no rotation, which is why every alternative Google offers hands you an hour-long token instead.
Free, with no sign-up. Every one runs entirely in your browser: nothing you paste is uploaded, and there is no server to send it to.
GCP Storage Bucket Analyzer
Two access systems, one visible
Check a Cloud Storage bucket for per-object ACLs alongside IAM, public access prevention left inherited, and allAuthenticatedUsers, which is not your users.
GCP Signed URL Decoder
A bearer token in a URL
Read a Cloud Storage signed URL: V4 or V2, how long it lives against the seven day cap, which service account signed it, and what it points at.
GCP Machine Type Decoder
The trailing letter is the architecture
Read a GCP machine type: the series and its processor, the memory family's ratio, and the custom memory band that decides rejected from billed as extended.
GCP Resource Name Parser
Project ID is not project number
Read a GCP resource name in any form: relative, full, self link or service account email. Names the project, the location, and whether it is an ID or a number.
GCP Cloud Run Config Analyzer
No CPU between requests
Check a Cloud Run service for CPU throttled between requests, memory shared across concurrent requests, and a CPU and memory pairing that will not deploy.
GCP Pub/Sub Subscription Analyzer
Duplicates are the ack deadline
Check a Pub/Sub subscription for the ack deadline behind duplicate delivery, a dead letter policy missing its IAM grants, and an expiration policy that deletes it.
GCP Firewall Rule Analyzer
On a tie, the deny wins
Read GCP VPC firewall rules in evaluation order, with the deny-wins tie-break, rules that target every instance in the network, and the two implied rules.
GCP IAM Policy Analyzer
allAuthenticatedUsers is public
Read a Google Cloud IAM allow policy: the public bindings, the enormous basic roles, and the roles that grant impersonation and reach further than they look.
GCP Service Account Key Analyzer
The credential that never expires
Read a Google Cloud service account key: which account it belongs to, the key id needed to revoke it, and why it is the one GCP credential with no lifetime.